skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-disk-encryption-with-bitlocker

Implements BitLocker full disk encryption on Windows endpoints with TPM and recovery key escrow.

954|172|Updated Mar 13, 2026
Search Tags:#data protection#endpoint security#bitlocker#intune#tpm#disk encryption#Windows security
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill implementing-disk-encryption-with-bitlocker
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-disk-encryption-with-bitlocker
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/endpoint-security/implementing-disk-encryption-with-bitlocker
Command: npx skills add https://github.com/xalgord/xalgorix --skill implementing-disk-encryption-with-bitlocker

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Windows endpoints that leave the office unencrypted expose all data at rest if a device is lost or stolen, creating compliance failures under PCI DSS, HIPAA, and GDPR. This Skill provides a complete workflow for deploying Microsoft BitLocker full disk encryption across an enterprise fleet with correct TPM configuration and recovery key escrow.

Core Features & Use Cases

  • TPM and prerequisite verification: Check TPM 2.0 presence, Secure Boot status, and current volume state before enabling encryption.
  • Multi-channel deployment: Configure BitLocker via GPO, PowerShell (Enable-BitLocker, manage-bde), or Microsoft Intune disk encryption profiles with XTS-AES 256.
  • Recovery key management: Escrow 48-digit recovery passwords to Active Directory or Azure AD and retrieve them via RSAT or Microsoft Graph.
  • Use Case: A security engineer needs to encrypt 500 laptops for HIPAA compliance. Use this Skill to enforce TPM+PIN protectors, escrow keys to Azure AD, and verify Protection On status across the fleet.

Quick Start

Enable BitLocker with TPM and PIN on drive C: using XTS-AES 256 and back up the recovery key to Active Directory.

Frequently Asked Questions about implementing-disk-encryption-with-bitlocker

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enable BitLocker with TPM and PIN using PowerShell?▼

Use Enable-BitLocker with the -TpmAndPinProtector parameter and a SecureString PIN, for example: Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -TpmAndPinProtector -Pin $pin. Then add a recovery password protector with Add-BitLockerKeyProtector.

How do I deploy BitLocker across an enterprise with Intune?▼

Create a disk encryption profile in Intune under Endpoint Security, requiring encryption for OS, fixed, and removable drives with XTS-AES 256. Configure TPM startup PIN requirements and escrow recovery keys to Azure AD, then assign the profile to managed device groups.

Does BitLocker work without a TPM chip?▼

BitLocker can run without a TPM if the GPO setting Allow BitLocker without compatible TPM is enabled, using a USB startup key instead. However, TPM 2.0 with UEFI Secure Boot is recommended for measured boot integrity and stronger protection.

Why is TPM-only BitLocker considered insecure for laptops?▼

TPM-only mode unlocks transparently at boot, leaving it exposed to cold boot attacks and DMA attacks via Thunderbolt or FireWire ports. Adding a startup PIN (TpmAndPin protector) and enabling Kernel DMA Protection mitigates these risks.

How do I verify BitLocker encryption status and compliance?▼

Run manage-bde -status C: and confirm Protection Status shows Protection On, Percentage Encrypted is 100.0%, and Encryption Method is XTS-AES 256. A drive can be fully encrypted but have protection suspended, so also check key protectors with manage-bde -protectors -get.

When should I not use BitLocker for disk encryption?▼

Do not use BitLocker on Linux systems, where LUKS/dm-crypt is the appropriate tool, or on macOS, where FileVault applies. BitLocker also requires Windows 10/11 Pro, Enterprise, or Education editions.

Related Skills

Explore More Software Engineering Skills→
wrcopilot-orgwrcopilot-org
2

mbr-gpt-conversion-guard

Converts MBR disks to GPT with boot-compatibility checks and validation before applying changes.

Official
Advanced
CastrozanCastrozan
3

phone-status

Collect phone battery, charging, uptime, load, and storage metrics over SSH into JSON.

Community
Intermediate
wrcopilot-orgwrcopilot-org
2

write-protection-unlock-assistant

Remove write protection from USB, SD, and external drives on Windows 10+.

Official
Intermediate
Fei2-LabsFei2-Labs
12

git-crypt

Manage git-crypt encrypted repositories with GPG and Bitwarden integration.

Official
Advanced